Jump to content

We need your help!

Swandog46

By Swandog46
in Malwarebytes News

Recommended Posts

Swandog46

Swandog46

Posted
Posted

We need your help.

We are trying to track down an issue where some users report Malwarebytes' Anti-Malware freezes during a scan. We think it may have to do with interference by the ZoneAlarm firewall.

If you are experiencing this problem, we would appreciate it greatly if you would gather some information for us, and then post it here. This is the the information we are looking for:

  1. Tell us if you are experiencing this problem, and describe it in detail please.
  2. Tell us if you have ZoneAlarm installed, and if it is enabled.
  3. Does the MBAM scan freeze always on the same file/object? If so, which one?
  4. Then please try the following debugging steps:
    • Open MBAM, go into the Settings tab and uncheck "Always scan memory objects".
    • Run a scan, and tell us if it still freezes.
    • Go back into Settings, and re-check "Always scan memory objects."
    • Then please uninstall ZoneAlarm completely, if you have it. Make sure to reboot afterwards!
    • Run an MBAM scan again, and tell us if it still freezes.
    • You can reinstall ZoneAlarm after completing the entire process.

Thank you very much. Help us to help you! :)

Link to post
toolboxx

toolboxx

Posted
Posted

I've been experiencing this exact same problem with v1.31 when scanning different machines; all of which have ZA Integrity Agent v4.5 installed.

Just ran into this thread...glad someone is looking into this, MBAM rocks!

1) Anyway, the freeze issue would start about 5-10 seconds into the scan until a reboot is required/

2) It would hang on a different file every time, usually in C:\Windows\System32

3) Our platform is locked down for most users; only seems to freeze on users that have Admin rights (most have developer tools & tons of apps)

4) Unchecking "Always scan memory objects" makes no difference

5) On one machine - uninstalled ZA, rebooted, unchecked scan memory and scan extra & heuristics objects = still freezes with 12/12 rules.

6) All machines are XP SP2 with Symantec Corp. 10.1

7) The freeze causes MBAM hang as well as explorer, taskmgr, etc.

8) Eventually, the machine becomes completely unresponsive, WMI across the network fails, etc. and have to hit the power button.

I work for an extremely large enterprise and have been running MBAM mostly for Trojan.Vundo removal.

Hope this helps!

BTW, 1st post! :angry:

Link to post
Blue-chan

Blue-chan

Posted
Posted

Hello everyone,

I decided to join this forum in order to reply to this topic; hopefully I'm not too late. It seems that I'm not the only one who experiences a problem with Malwarebytes' Anti-Malware freezing during a full scan.

Here's a complete (enough, I hope) detail on my error:

  • I'm using ZoneAlarm Firewall, the free version.

    .


  • Apparently MBAM doesn't only freeze in on one file. Over multiple attempted full scans, I've had it freeze at the following files:
    1. C:\Psfonts\Pfm\ENGRTT__.PFM
    2. C:\Psfonts\Pfm\Jazzet__.PFM
    3. D:\Zone Labs\ZoneAlarm\MailFrontier\resources\otzaenu.dll
    4. D:\Zone Labs\ZoneAlarm\repair\ (some hexadecimal name).key <--- it froze on one of the four *.key files, but I don't remember which and I couldn't get it to scan and freeze there again.
  • When it freezes, it doesn't affect other parts of the computer. Only the MBAM window is frozen (it becomes white if I ever switch to other windows), and I can still do anything else normally.

    .


  • Once I hit the "X" to close the window when it freezes, it comes up with the "This program is not responding". Hit "End now" and it'll come up with "Would you like to report this error to Microsoft?".

Hopefully that's helpful enough!

Link to post
Ernie B.

Ernie B.

Posted
Posted

We need your help.

We are trying to track down an issue where some users report Malwarebytes' Anti-Malware freezes during a scan. We think it may have to do with interference by the ZoneAlarm firewall.

If you are experiencing this problem, we would appreciate it greatly if you would gather some information for us, and then post it here. This is the the information we are looking for:

-----------------------------------------------------------------------------------------------

Windows 2000 Pro, 512 Mbytes RAM.

1. Tell us if you are experiencing this problem, and describe it in detail please.

Yes. The full scan freezes MBAM 20 minutes, 28 seconds into the scan, 75828 objects scanned. C:\Program Files\zone labs\repair\vsinit.dll is being scanned when it freezes. When MBAM freezes a buzzing sound is heard, apparently from a hard drive.

When things freeze up other windows may be opened but not closed. MBAM cannot be terminated, is non-responsive. Task manager shows that MBAM is "Not Responding" but "End Task" shows "Program cannot be closed..." The Process Manager will not end mbam.exe, shows "Access Denied". It is necessary to reset the computer

2. Tell us if you have ZoneAlarm installed, and if it is enabled.

Yes, both installed and enabled.

3. Does the MBAM scan freeze always on the same file/object? If so, which one?

The problem appeared the other day, didn't record the file it was scanning when it froze. The elapsed time was about the same.

4. Then please try the following debugging steps:

* Open MBAM, go into the Settings tab and uncheck "Always scan memory objects".

Done.

* Run a scan, and tell us if it still freezes.

Done. Did not freeze up. Log exerpt:

Scan type: Full Scan (C:\|D:\|E:\|)

Objects scanned: 125845

Time elapsed: 24 minute(s), 23 second(s)

* Go back into Settings, and re-check "Always scan memory objects."

Done.

* Then please uninstall ZoneAlarm completely, if you have it. Make sure to reboot afterwards!

Done. ZA version:

ZoneAlarm version:7.0.483.000

TrueVector version:7.0.483.000

Driver version:7.0.483.000

* Run an MBAM scan again, and tell us if it still freezes.

Yes, MBAM freezes again. Same symptoms as above. It froze after 20 minutes, 54 seconds while scanning C:\Program Files\Winzip\WZCab3.dll. It had not found any infected files to that point.

Link to post
acooldozen

acooldozen

Posted
Posted

ZoneAlarm 7.0.337.000 (free) installs a software called 'MailFrontier', (not sure if it is in the above version or not, but worth checking) which in turn installs a scanner & toolbar in Outlook. I am not sure if everybody wants that - I certainly don't!

Unlike with 7.0.302.000, there is no uninstaller in Add/Remove Programs. However, there is still a way to uninstall it:

Close Outlook

Windows Explorer, open C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier

Double-click UNWISE.EXE

When prompted for the install.log file, use C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\INSTMLF.LOG

on the MailFrontier uninstall panel, select Automatic [Next>], then [Finish]

Link to post
Ernie B.

Ernie B.

Posted
Posted
ZoneAlarm 7.0.337.000 (free) installs a software called 'MailFrontier', (not sure if it is in the above version or not, but worth checking) which in turn installs a scanner & toolbar in Outlook. I am not sure if everybody wants that - I certainly don't!

Unlike with 7.0.302.000, there is no uninstaller in Add/Remove Programs. However, there is still a way to uninstall it:

Close Outlook

Windows Explorer, open C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier

Double-click UNWISE.EXE

When prompted for the install.log file, use C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\INSTMLF.LOG

on the MailFrontier uninstall panel, select Automatic [Next>], then [Finish]

Thanks. I found a MailFrontier folder, even though I opted not to install the toolbar when I reinstalled ZA. I don't use Outlook so the toolbar has never been an issue, but the less junque the better.

Link to post
Dennis9900

Dennis9900

Posted
Posted

1. Tell us if you are experiencing this problem, and describe it in detail please.

2. Tell us if you have ZoneAlarm installed, and if it is enabled.

3. Does the MBAM scan freeze always on the same file/object? If so, which one?

4. Then please try the following debugging steps:

* Open MBAM, go into the Settings tab and uncheck "Always scan memory objects".

* Run a scan, and tell us if it still freezes.

* Go back into Settings, and re-check "Always scan memory objects."

* Then please uninstall ZoneAlarm completely, if you have it. Make sure to reboot afterwards!

* Run an MBAM scan again, and tell us if it still freezes.

* You can reinstall ZoneAlarm after completing the entire process.

1.

- Experienced lockup during full scan using Malwarebytes Anti-Malware (MBAM) with database 1507

- MBAM stopped responding while showing:

Currently scanning:

C:\System Volume Information\MountPointManagerRemoteDatabase

- I ran the full scan because earlier in the day NTBackup froze and did not complete backup on the same file

- Since posting last night I used Microsoft KB30951 to gain access to C:\System Volume Information

- MountPointManagerRemoteDatabase is a 0 byte file used by System Restore

- PC is Dell GX270, XP Pro SP3, ZoneAlarm as described below

- Ran MBAM full scan on another PC (HP ze4900 laptop) running same MBAM and ZoneAlarm with no problem.

- Ran MBAM quick scan on another PC (Compaq 2175 laptop) running same MBAM and ZoneAlarm (I have a 3-user pack) with no problems.

2.

- ZoneAlarm Security Suite version 8.0.059.000

- TrueVector security engine version 8.0.059.000

- Driver version 8.0.059.000

- Anti-virus engine version 6.0.2.678, DAT file version 965821969

- Anti-spywre engine version 5.0.202.0, DAT file version 01.200812.5015

- AntiSpam version 5.0.61.9957

Note: ZoneAlarm was shut down during this run and the network cable was unplugged.

3. No, MBAM stops at a different spot this time.

4.1 Unchecked "Always scan memory objects".

4.2 Ran a full scan, still freezes on a different file yet.

4.3 Re-checked "Always scan memory objects".

4.4 Uninstall ZA. Not yet. Before uninstalling I need to make sure all my firewall rules and settings are preserved.

Thanks,

Dennis

Link to post
Dennis9900

Dennis9900

Posted
Posted

... continued from yesterday.

4.4 Uninstalled ZoneAlarm, rebooted.

4.5 Ran MBAM again and it still crashed, again on System Volume Information\MountPointManagerRemoteDatabase. Repeated this after another clean reboot and it crashed yet again in the same place. My response in #3 above was that it crashed in a different spot on that run. An anomaly or operator error? Please read on.

4.6 Re-installed ZoneAlarm.

To further isolate the problem I did two more things.

1. After more study I determined that I could delete C:\System Volume Information and all its contents, and that Windows XP Pro would rebuild it so I'd have clean files "tracking.log" and "MountPointManagerRemoteDatabase". I did that, no problem.

2. On the next reboot I also let MBAM check for updates and found Database version 1512. The failure in my troubleshooting is that I applied 1512 before running MBAM again. The success is that I ran MBAM in both Quick and Full Scan modes with no malware detected and no crashes.

So at this point, I am uncertain whether rebuilding the root folder that holds Restore Point information or the updated MBAM database resolved the issue, but as far as MBAM is involved, I'm back to feeling good.

That said, my original problem of NTBackup freezing on that root folder still existed. As a workaround, I merely unchecked C:\System Volume Information so that it is not included in the backup. I suspect the real fix for this will come from Microsoft.

Thank you very much for your interest and I hope that in some way my efforts will assist you.

Regards,

Dennis

Link to post
nosirrah

nosirrah

Posted
Posted
Does anyone have an update on v1.32?

I'm getting very frustrated :) with this version hanging up and causing lockups/BSOD, etc.

Others mention that it's hangs on C:\System Volume Information but this folder cannot be excluded?

Help! We are considering purchasing this product and this does not look good.

Quick scan excludes it and detects 100% of the malware that can enter memory that full scan does .

I make the defs for MBAM and not a single time ever have needed to use full scan to remove what I am testing .

The only thing full scan can do better it catch 1% more dead traces and that is only after you have been infected . If you have not been infected it will never detect anything more than quick scan .

As far as the error , are you contributing data to our developers so we can work out the issue ? There is a lot of data in this thread on how to do that .

Link to post
Swandog46

Swandog46

Posted
  • Author
Posted

toolboxx, we don't know why it happens yet, because it happens only to a small number of machines and we can't duplicate the conditions ourselves in the lab. Do you get the freezing condition with "Always Scan Memory Objects" unchecked, on Quick Scan, with/without ZoneAlarm installed? Would you be willing to help us debug when we have a debugging version ready?

Link to post
Istvan

Istvan

Posted
Posted

Hi everyone!

Unfortunately I'm experiencing the exact same problem.I have uninstalled and reinstalled many many times even disabled my AVG firewall also,but it did not work..

Usualy it stops and freezes over the same file wich is : C:\system volume information

The quick scan seems to be working fine,but the full scan does not.I don't have ZoneAlarm installed on my laptop , but I use the paid version of mbam..

I'll take every opinion or help..Thank you so much !!!

(Sorry about my English,Obviously is not my native tounge :) )

post-6843-1229787838_thumb.jpg

post-6843-1229787838_thumb.jpg

Link to post
Guest
This topic is now closed to further replies.
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.